Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0673
MITRE ATT&CK Malware

DarkWatchman (S0673)

ShareXLinkedInRedditHN

[DarkWatchman](https://attack.mitre.org/software/S0673) is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.(Citation: Prevailion DarkWatchman 2021)

Platforms: Windows

▪Techniques implemented (34)

T1614System Location DiscoveryT1070.004File DeletionT1027.011Fileless StorageT1027.015CompressionT1112Modify RegistryT1490Inhibit System RecoveryT1074.001Local Data StagingT1010Application Window DiscoveryT1059.001PowerShellT1124System Time DiscoveryT1083File and Directory DiscoveryT1027.010Command ObfuscationT1568.002Domain Generation AlgorithmsT1012Query RegistryT1129Shared ModulesT1217Browser Information DiscoveryT1132.001Standard EncodingT1059.003Windows Command ShellT1573.002Asymmetric CryptographyT1071.001Web ProtocolsT1005Data from Local SystemT1140Deobfuscate/Decode Files or InformationT1047Windows Management InstrumentationT1566.001Spearphishing AttachmentT1027.004Compile After DeliveryT1053.005Scheduled TaskT1518.001Security Software DiscoveryT1056.001KeyloggingT1036MasqueradingT1082System Information DiscoveryT1033System Owner/User DiscoveryT1070Indicator RemovalT1059.007JavaScriptT1120Peripheral Device Discovery
S0673on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.